The Maryland Online Data Privacy Act (MODPA) took effect on 1 October 2025 and has applied to processing since 1 April 2026. It bans the sale of sensitive data even with consent, bans targeted advertising to anyone a business knew or should have known is under 18, and limits data collection to what is reasonably necessary. The Attorney General's discretionary 60-day cure period covers violations up to 1 April 2027.
What the Maryland Online Data Privacy Act does
Maryland Governor Wes Moore approved the Maryland Online Data Privacy Act on 9 May 2024, as Senate Bill 541 (2024). The statute took effect on 1 October 2025, and the enacting Act says it has no effect on personal data processing activities before 1 April 2026. It is now codified at sections 14-4701 onwards of the Commercial Law Article.
MODPA is widely regarded as one of the strictest US state privacy laws enacted to date. Where most state frameworks follow the Virginia opt-out model with relatively broad allowances for data use, Maryland imposes tighter constraints on data collection, sensitive data handling and advertising directed at young people.
The law is enforced by the Maryland Attorney General through the Consumer Protection Division. Consumers cannot sue under MODPA itself.
Who MODPA applies to
MODPA applies to organisations that conduct business in Maryland or target products and services to Maryland residents. Two thresholds determine applicability, and meeting either one brings an organisation within scope.
| Threshold | Requirement |
|---|---|
| Volume-based | Process personal data of at least 35,000 Maryland consumers per year (excluding data processed solely to complete a payment transaction) |
| Revenue-based | Derive more than 20% of gross revenue from the sale of personal data and process data of at least 10,000 Maryland consumers per year |
Nonprofits are generally covered. Section 14-4703 exempts only a nonprofit controller that processes or shares personal data solely to assist law enforcement agencies investigating insurance crime or fraud, or first responders responding to catastrophic events. Government bodies, national securities associations and financial institutions subject to the Gramm-Leach-Bliley Act are exempt, and data such as HIPAA-protected health information is excluded.
Data minimisation: MODPA's defining feature
Data minimisation is the provision that sets MODPA apart from most other state privacy laws. Most frameworks allow broad data collection so long as consumers can opt out. MODPA reverses that approach.
Under section 14-4707 of the Commercial Law Article, controllers must limit the collection of personal data to what is "reasonably necessary and proportionate to provide or maintain a specific product or service requested by the consumer". Processing for a purpose that is neither reasonably necessary to, nor compatible with, the purposes disclosed to the consumer needs the consumer's consent.
For sensitive data, the bar is higher. A controller may not collect, process or share sensitive data except where it is "strictly necessary" to provide or maintain a specific product or service the consumer requested. A website cannot collect biometric identifiers, precise geolocation, health data or genetic information just because a privacy policy discloses it. The collection must be tied to a genuine functional need.
Sensitive data cannot be sold, even with consent
MODPA bans the sale of sensitive data outright. Even if a visitor affirmatively agrees, a controller may not sell their sensitive personal data.
The definition of sensitive data under MODPA is broad:
- Racial or ethnic origin
- Religious beliefs
- Consumer health data, including data related to gender-affirming treatment and reproductive or sexual health care
- Sex life or sexual orientation
- Status as transgender or nonbinary
- National origin
- Citizenship or immigration status
- Genetic and biometric data
- Personal data of a known child
- Precise geolocation
This prohibition creates a hard boundary that consent alone cannot overcome. Under the CCPA, by contrast, sensitive personal information can be sold, subject to the consumer's right to opt out and to limit its use.
Children's data and targeted advertising restrictions
MODPA introduces some of the strongest protections for young people's data among US state laws. A controller may not process a consumer's personal data for targeted advertising, or sell it, if the controller knew or should have known that the consumer is under 18. No consent overrides either rule.
The knowledge standard is deliberately broad. It contrasts with COPPA, which covers children under 13 and turns on actual knowledge for general-audience sites. Maryland's approach places a heavier burden on businesses to recognise and protect younger visitors.
Organisations running analytics or marketing pixels on sites likely to attract teenagers should review whether those scripts collect data used for targeted advertising or profiling. Cookies such as _fbp, _gcl_au and similar advertising identifiers would need to be suppressed when the visitor is, or should be known to be, under 18.
Consumer rights under MODPA
MODPA grants Maryland consumers a set of rights broadly consistent with other state frameworks, though some carry additional weight given the law's minimisation requirements.
Access, correction and deletion
Consumers can confirm whether a controller processes their personal data, access it, correct inaccuracies, have it deleted and obtain a portable copy. They can also get a list of the categories of third parties that received their data. Controllers must respond within 45 days, with a possible 45-day extension if reasonably necessary, and an appeal must be answered within 60 days.
Opting out
Consumers may opt out of targeted advertising, the sale of personal data, and profiling in furtherance of solely automated decisions with legal or similarly significant effects. A controller may not require authentication for an opt-out request.
For opt-outs, the statute names two methods: a clear and conspicuous link to an opt-out page, and, from 1 October 2025, an opt-out preference signal such as Global Privacy Control sent with the consumer's consent. Many summaries list Maryland among the states that require businesses to honour these signals, and honouring one costs little, so treat a GPC signal as a valid opt-out for Maryland visitors.
Any consent you do collect must be as easy to revoke as it was to give, and processing must stop within 30 days of a revocation.
Data protection assessments
MODPA requires controllers to conduct data protection assessments for processing that presents a heightened risk of harm. These include:
- Processing personal data for targeted advertising
- Selling personal data
- Processing sensitive data
- Profiling that presents a reasonably foreseeable risk of unfair or deceptive treatment, financial or physical injury, or intrusion on solitude or seclusion
The assessment must weigh the benefits of processing against the risks to consumer rights. Controllers should document these assessments and retain them, as the Attorney General may request them during an investigation. Organisations already conducting data protection impact assessments under the GDPR will find the format familiar, though the legal tests differ.
Enforcement and penalties
Under section 14-4713, a MODPA violation is an unfair, abusive or deceptive trade practice under Maryland's Consumer Protection Act, enforced by the Consumer Protection Division. For violations that occur on or before 1 April 2027, section 14-4714 lets the Division issue a notice of violation first, if it decides a cure is possible, and then give at least 60 days to cure.
This cure period is not guaranteed. The Division may weigh several factors when deciding whether to offer it, including the number of violations, the size of the business, the likelihood of injury to the public and whether the violation was a human or technical error. For violations after 1 April 2027, no cure provision applies.
| Penalty type | Amount |
|---|---|
| Initial violation | Up to $10,000 per violation |
| Repeat violation | Up to $25,000 per subsequent violation |
These amounts come from section 13-410 of the Consumer Protection Act. Given the per-violation structure, failures across thousands of consumer records could result in substantial total fines.
How MODPA compares with other state privacy laws
The table below highlights where MODPA diverges from other major US state privacy frameworks.
| Feature | MODPA (Maryland) | CCPA/CPRA (California) | VCDPA (Virginia) |
|---|---|---|---|
| Data minimisation | Reasonably necessary and proportionate standard | No standalone requirement | Limited to disclosed purpose |
| Sensitive data sale | Prohibited entirely | Permitted, subject to opt-out and the right to limit | Permitted with opt-in consent |
| Age limit for targeted advertising rules | Under 18 | Under 16 | Under 13 (aligned with COPPA) |
| Knowledge standard for minors | Knew or should have known | Actual knowledge (wilful disregard counts) | Actual knowledge |
| Universal opt-out signals | Named in the statute from 1 Oct 2025 | Required | Not required |
| Private right of action | No | Yes (data breaches only) | No |
| Cure period | Discretionary, at least 60 days, until 1 Apr 2027 | None guaranteed | 30 days (permanent) |
What website owners should do now
MODPA has applied to processing since 1 April 2026, so any gap on a site with Maryland visitors is already live.
Audit your data collection
Review every cookie, pixel and tracking script on your site. Identify which ones collect data beyond what is needed to deliver the service your visitor requested. A thorough cookie audit is a practical first step, and Kukie.io's free cookie scanner shows what your site sets before and after consent.
Review sensitive data flows
Map where sensitive data categories, such as health information, precise geolocation and biometric identifiers, enter your systems. If any of these data types are sold to third parties, those flows must stop under MODPA regardless of consent.
Update your consent mechanism
Make sure your cookie banner supports opt-out requests for targeted advertising and data sales and recognises universal opt-out signals such as GPC. If your site serves visitors under 18, keep advertising cookies and data-sale mechanisms off for those users.
Conduct data protection assessments
If you process personal data for targeted advertising, sell data or profile consumers, complete and document the required assessments. Keep records accessible for potential review by the Attorney General.
Short answers on Maryland's privacy law
When does MODPA enforcement begin?
MODPA took effect on 1 October 2025 and has applied to personal data processing since 1 April 2026. For violations up to 1 April 2027, the Consumer Protection Division may offer a cure period of at least 60 days, but it does not have to.
Does MODPA apply to small businesses and nonprofits?
It applies to organisations that process data of at least 35,000 Maryland consumers a year (excluding payment-only data), or of at least 10,000 while deriving more than 20% of gross revenue from selling data. Nonprofits are covered unless they process data solely to assist law enforcement with insurance crime or first responders in catastrophic events.
Can I sell sensitive data if the consumer consents?
No. MODPA prohibits the sale of sensitive personal data under any circumstances, even with explicit consumer consent. This is a departure from most other US state privacy laws.
Does MODPA require a cookie consent banner?
MODPA does not specifically mandate a cookie banner, but it requires honouring opt-out requests for targeted advertising and data sales and names opt-out preference signals like GPC as a way to receive them. A properly configured consent mechanism is the most practical way to meet these obligations.
How does MODPA protect children's data?
MODPA prohibits targeted advertising to, and the sale of personal data of, consumers the controller knew or should have known are under 18. The standard places a higher burden on businesses than the actual-knowledge requirement found in most other state laws.
What penalties can the Maryland AG impose for MODPA violations?
Under the Consumer Protection Act, fines of up to $10,000 per violation and up to $25,000 for each repeat of the same violation. The Attorney General may also seek injunctive relief.
Find the trackers Maryland's minimisation rule questions
If you are not sure which cookies your site sets or whether your data collection meets MODPA's minimisation standard, start with a free scan. Kukie.io finds and categorises every cookie, applies the consent model you set for each region, and keeps a record of each choice.
